Skip to content
HackIndex logo

HackIndex

VNC Authentication Probing

3 min read Jan 19, 2026

VNC auth “probing” is reading the RFB security types the server offers. That tells you if the desktop is open, password-gated, or wrapped in TLS or vendor auth before you waste time with the wrong client.

Fast path

Probe a single port:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p $PORT --script vnc-info $TARGET_IP 
PORT    STATE SERVICE
5900/tcp open  vnc
| vnc-info:
|   Protocol version: 3.889
|   Security types:
|     Mac OS X security type (30)
|_    Mac OS X security type (35)

Probe common displays:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5900-5910 --script vnc-info $TARGET_IP

vnc-info returns the RFB version and supported security types.

Interpreting security types

The decision point is the security type list. Common values you’ll see in the wild:

1 None

  • No authentication at the VNC layer.

  • Next move: connect with a viewer immediately and validate you get a desktop.

2 VNC Authentication

  • Classic VNC password challenge-response.

  • Next move: credential validation or controlled password auditing.

18 TLS / 19 VeNCrypt

  • You need a client that supports the offered crypto wrapper.

  • Next move: try a modern viewer and don’t assume “not reachable” if your first client errors.

If you want the protocol-level meaning of “None” vs “VNC Authentication”, RFC 6143 is the authoritative reference.

Confirm with a real viewer

Nmap tells you what’s offered. A viewer tells you what works and whether you land on a usable desktop.

TigerVNC vncviewer will prompt for a password if required.

┌──(kali㉿kali)-[~]
└─$ vncviewer $TARGET_IP:$PORT

What to do with the behavior:

  • Immediate desktop without a prompt usually matches None.

  • Password prompt matches VNC Authentication or a compatible extended type.

  • “No matching security types” means the server offered types your client doesn’t support. Switch client or tune security options instead of assuming it’s dead.

Detect “no-auth VNC” quickly across many hosts

When you’re sweeping a network, you’re often hunting for None first.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -n --open -p 5900-5910 --script vnc-info -iL targets.txt -oA vnc-auth-probe
grep -Rni "None" vnc-auth-probe.nmap

This is usually enough to prioritize immediate interactive access attempts.

Edge cases

Viewer says “No matching security types”

That’s almost always client capability mismatch, not “wrong creds”. The server is advertising security types your viewer can’t do. Use vnc-info to see what’s being offered, then switch viewers or enable support for that type.

Port is open but no RFB banner

If you don’t see an RFB version string with a raw connect, you’re probably not talking to VNC on that port.

┌──(kali㉿kali)-[~]
└─$ nc -nv $TARGET_IP $PORT

If it’s VNC, you should see RFB 003.xxx early in the handshake.

Legacy

Notice

RealVNC auth-bypass checks target a very old RealVNC issue (CVE-2006-2369). Keep it as a quick legacy sanity-check, not a primary path.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p $PORT --script realvnc-auth-bypass $TARGET_IP

References